Skip to main content
Create a Consumer Key / Secret pair for each turboSMTP integration. Use the pair for SMTP, HTTP sending, or supported management API operations, with permissions chosen for that application’s needs.

​
Create credentials

1

Open API keys

Sign in to the dashboard and open Settings → Integrations → API Keys → Edit.
2

Configure a key

Start creating a key and enter a descriptive label. Select the services it may use. Optionally restrict access to your application’s public outgoing IP addresses.
3

Store the key and secret

Generate the key pair and copy the Consumer Key and Consumer Secret to your password manager or application secret store. The secret is shown only when the pair is created.
If you lose a Consumer Secret, create a replacement key pair. Update and verify every application that uses the old pair before deleting the old key. Do not put secrets in source control, browser code, or support messages.

​
Permissions

One pair can have several permissions. Grant only those required by the application. Consumer-key management and password changes still require a session API key; see authentication exceptions.

​
Key limits

See the current pricing comparison for plan limits. If you reach your limit while rotating credentials, plan the replacement before deleting an active key.

​
IP restrictions

An IP-restricted key can only be used from its allowed addresses. Configure the public outgoing addresses of your servers, rather than private LAN addresses. Account for address changes or additional outgoing gateways when deploying your application.

​
SMTP

SMTP credentials
Enable SMTP Sending. The username is the Consumer Key and the password is the Consumer Secret. Your dashboard login password is not the SMTP password. Both hosts also support STARTTLS on 25 and 2525, and implicit TLS on 25025; see SMTP setup.

​
HTTP sending

Send an email
Enable HTTP API Sending. Use https://api.eu.turbo-smtp.com/api/v2/mail/send for the EU sending route. Authorization is ignored by this endpoint and cannot replace the Consumer headers.

​
Management APIs

Enable Statistics & Management APIs and pass both Consumer headers on supported management calls:
List suppressions
Use Consumer credentials for your integrations. Email/password /authorize login is only needed for a few session-only operations. See authentication for those exceptions and the login rate limit.

​
Legacy credentials

Some older accounts have an automatically generated Consumer Key whose value equals the account email. The API identifies it with is_legacy: true; it may not be shown in the dashboard key list. It still represents a Consumer Key with its associated secret. Do not replace a newly created key with your email address. New sub-accounts need a key pair of their own.

​
Edit or revoke credentials

Open Settings → Integrations → API Keys → Edit to manage your keys. Delete a key when you no longer need it or suspect compromise. Update applications before revoking a pair that is still in use. For programmatic creation, listing, updates, and deletion, see the Consumer Keys API.